{"id":"CVE-2026-85103","published":"2026-09-09T13:00:42Z","modified":"2026-09-10T03:56:41Z","title":"Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding","vendor":"checkpoint","product":"Quantum Security Gateway","tier":"core","eol":null,"affectedVersions":[{"vendor":"checkpoint","product":"Quantum Security Gateway","versions":["R82.10 with Jumbo Hotfix Take 43 or below","R82 with Jumbo Hotfix Take 125 or below","R81.20 with Jumbo Hotfix Take 165 or below"]},{"vendor":"checkpoint","product":"Quantum Security Management","versions":["R82.10 with Jumbo Hotfix Take 43 or below","R82 with Jumbo Hotfix Take 125 or below","R81.20 with Jumbo Hotfix Take 165 or below"]}],"description":{"text":"A heap-based buffer overflow in VPN certificate ASN.1 decoding may allow an unauthenticated remote attacker to execute arbitrary code on Check Point Quantum Security Management and Quantum Security Gateway systems.","provenance":"source","from":"CVE.org"},"summary":{"text":"A heap-based buffer overflow in the VPN certificate ASN.1 decoding component of Check Point Quantum Security Gateway (and Quantum Security Management) can be triggered when the software parses certificates. An unauthenticated remote attacker with network access can exploit it without user interaction or a specific configuration to execute arbitrary code on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:53Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.04287,"percentile":0.91119,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-122","name":"Heap-based Buffer Overflow"}],"references":[{"url":"https://support.checkpoint.com/results/sk/sk1000118","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-75010","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75010","exploited":true,"exploitedSince":"2026-09-25","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-09-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-85103","provenance":"source"},{"date":"2026-09-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-75010","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.1,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.22,"detail":"percentile 0.9112"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}